Zero Radar
← feed
HighVulnerabilityCVE-2026-96196updated 29 Oct 2026, 20:04 UTC

Microsoft Edge can be tricked into bypassing a security check

A flaw in Microsoft Edge lets an attacker get past one of the browser's built-in safety checks over the network. Because the check fails to block certain inputs, the browser may trust content it should have rejected.

Official, 3 sources
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerCrafts malicious web content or request
  2. 2NetworkContent delivered over the network
  3. 3Edge browserInput check misses disallowed values
  4. 4Security bypassProtection feature is circumvented
  5. ResultBrowser security feature is bypassed

What happened

Microsoft Edge (Chromium-based) has an incomplete list of disallowed inputs, which allows an unauthorized remote attacker to bypass a security feature.

Why it is dangerous: A successful bypass weakens the browser's protections, so anyone who browses to attacker-controlled content in an affected Edge version could be at greater risk.

Are you affected?

You are affected if you run an unpatched Microsoft Edge (Chromium-based) version.

Microsoft Edge (Chromium-based); specific versions unknown

What to do

  1. Check your Edge version via edge://settings/help and confirm it is up to date
  2. Install the latest Microsoft Edge security update from Microsoft's official release notes
  3. Avoid visiting untrusted websites until the browser is updated

Timeline

  1. 27 Oct 2026, 14:00 UTC
    Publicly disclosed
  2. 27 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 27 Oct 2026, 20:36 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 16:20 UTC
    NVD reported on it · NVD
  5. 29 Oct 2026, 20:04 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-96196 · GHSA-7phf-ffjc-xfm7
CVSS
8.8 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 14:00 UTC
On Zero Radar
27 Oct 2026, 20:36 UTC (7 h after disclosure)
Last change
29 Oct 2026, 20:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Microsoft Edge can be tricked into bypassing a security check · Zero Radar